UseHttpsRedirection configures ASP.NET Core middleware that answers HTTP requests with a redirect to the same URL over HTTPS. HTTPS protects request and response contents from interception or tampering and requires a certificate. section 9.3
Basic configuration and verification
Add app.UseHttpsRedirection(); to Program.cs. Requesting http://localhost:<port>/swagger/index.html should return status 307 with a Location header containing the HTTPS URL. The .NET CLI can install a trusted development certificate with dotnet dev-certs https --trust. section 9.3
Choose the deployment strategy deliberately:
- Avoid exposing an HTTP port by placing the service behind a proxy that terminates HTTPS and manages the certificate. section 9.3
- Use HSTS with redirection when browsers should treat the site as HTTPS-only; enable HSTS in production rather than development. section 9.3
Listing 9.3 Enabling HSTS in production
var app = builder.Build();
if (app.Environment.IsProduction()) #1
{
app.UseHsts(); #2
}
Shows a production-only UseHsts configuration that complements HTTPS redirection. section 9.3
